Infrastructure incidents, decoded.
AlertINT turns infrastructure alerts into investigated incidents and serves them to the AI tools you already use, over MCP — a self-hosted agent that runs inside your own network.
A single Go binary that sits between your monitoring stack and your AI agent. It ingests alert webhooks from Alertmanager and Zabbix, correlates them into incidents through an open rule engine, and runs an LLM triage that falsifies its own draft verdict before the finding ships. Findings go to Slack; the incident state — plus read-only Prometheus, Loki, and Zabbix access — is exposed to any MCP client. Corrections your agent captures over MCP steer the next triage of the same failure. Read-only by design. Local state. You bring the LLM key.
Full documentation: alertint.com/docs
Install the binary with Go:
go install github.com/alertint/alertint-agent/cmd/alertint@latestThe released multi-architecture Docker image is
ghcr.io/alertint/alertint-agent:latest. The
Quickstart is the
canonical walkthrough for the bundled Docker Compose stack, configuration,
and proving the whole pipeline with one command:
alertint drill --config config.yamlFor Kubernetes, install the official OCI Helm chart:
helm install my-alertint oci://ghcr.io/alertint/charts/alertint-agent \
--set secret.create=true \
--set secret.data.ALERTINT_WEBHOOK_TOKEN="$(openssl rand -hex 32)" \
--set secret.data.ANTHROPIC_API_KEY=sk-ant-...For a production installation, manage the Secret outside Helm and use a reviewed values file; the chart README documents all supported modes.
The built-in incident drill plants a fake deploy, fires a burst of clearly-marked synthetic alerts through the production ingress, and polls until triage prints the finding — a causal analysis naming the planted deploy. From zero to that finding takes about ten minutes; then connect an MCP client to investigate it, and point Alertmanager or Zabbix at the agent for real alerts.
Two loops close on the triage step: the verification round gathers evidence chosen to disprove the model's own draft and makes it re-judge before anything persists, and an operator correction captured over MCP lands in incident memory, where it steers the next triage of that failure group.
The whole pipeline — receivers, correlation, the evidence pack, both loops, and the MCP surface — is diagrammed and walked through step by step in Architecture.
- Docs home — quickstart, configuration reference
- Architecture — how the pipeline is built
- Integrations — MCP clients, Zabbix, Prometheus, Loki, Slack
- Verification round and incident memory — how triage checks itself and learns from corrections
- Scope and limits — what it will and won't do
- FAQ
- Changelog — notable changes and upgrade notes by release
The /docs folder in this repo is the canonical source for those pages — the website renders it at build time. Documentation PRs are welcome here; see docs/README.md and CONTRIBUTING.md.
- Questions — GitHub Discussions (Q&A for "does it work with X", Ideas for what you wish it did)
- Bugs — Issues
- Security — never in public; see SECURITY.md
AlertINT is Fair Source, licensed under FSL-1.1-ALv2 (Functional Source License). Free to read, use, modify, and self-host at any scale. The only restriction is offering the software to others as a competing commercial product or service. Each release converts to Apache 2.0 — full open source — two years after publication. See fsl.software for the license text.